Troubling Log Entries in HA Core

[GrizzlyAK (Shane)]

Never seen either of these two log entries before. Anybody know what they mean? This was a log entry in Home Assistant Core.

(1)

Logger: homeassistant.components.http.security_filter
Source: components/http/security_filter.py:91
Integration: HTTP (documentation, issues)
First occurred: August 27, 2026 at 2:28:49 PM (26 occurrences)
Last logged: 4:43:35 PM

Filtered a potential harmful request to: /static../.aws/credentials
Filtered a potential harmful request to: /files../.env
Filtered a potential harmful request to: /assets../../../.env
Filtered a potential harmful request to: /media../.env
Filtered a potential harmful request to: /proc/self/environ

(2)

Logger: homeassistant.components.http.ban
Source: components/http/ban.py:138
Integration: HTTP (documentation, issues)
First occurred: August 27, 2026 at 2:28:50 PM (2 occurrences)
Last logged: 4:42:48 PM

Login attempt or request with invalid authentication from localhost (127.0.0.1). Requested URL: '/api/config'. (anthropic-ai)
Login attempt or request with invalid authentication from localhost (127.0.0.1). Requested URL: '/api/config'. (Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot))

[Deedee]

I’m not having this issue, but I remember reading this post a while back, sounds similar to yours ?

Is my system compromised?

For two days now, I have been getting the notification like below saying that there has been an invalid authentication from the Local host IP 127.0.0.1. I am running my HA on a Rasberry PI, and do use Nabu Casa. The time stamps for these seem to happen in the middle of the night and none of my PC’s are on-line during these times, so don’t think it happening from on of my local network computers. If I am compromised, I’m not sure the best way to fix it. Does anyone have some guidance? [homea…

[GrizzlyAK (Shane)]

Perhaps. I have seen notifications about authentication errors or something similar related to nabu casa at times. Can’t remember if it was also related to Local Host. But this is the first time I’ve seen either of these, ever.

I use an iPhone to access HA via both WiFi and Naba Casa cloud remotely. The second log entry seems to be saying that some one was trying to log into Anthropic AI and Perplexity and HA blocked it. But that seems to would have had to have been the HA iPhone Mobile App. No other traffic is routed through HA to the internet. It’s ONLY connection to the internet is via internal HA code and Nabu Casa back door. Perhaps the iPhone mobile app is tying into Apple’s AI infrastructure, but I do not remember giving that permission.

The first log entry isn’t very helpful with the abbreviated paths. Although, the full paths may be in the real logs (I have not checked).

Somebody should know what these mean., right?